Splunk Search

Correct syntax of eval string case

itnewbie
Explorer

I have a "Severity Level" field in both index A and index B.


Their structure is like:

 

 

==index A===
Severity Level
1
2
3
4

===index B===
Severity Level
critical
high
medium
low

 

 

 Now I want to combine the two indexes in a search and display the Severity Level using 

 

 

| timechart count by "Severity Level"

 

 

where the combined "Severity Level" values only contain 1,2,3,4

So, I need an eval = case() to map them.

My syntax for for that is 

 

 

eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level'  == 2, 2, 'Severity Level'  == 3, 3, 'Severity Level'  == 4, 4, 1=1, null)

 

 

 By this, the result gives incorrect result, i.e., only showing incorrect counts on 4. I think the problem is in the single and double quote, but I am not sure which is which. It is a bit urgent so I need help. Thanks. 

Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

There doesn't appear to be anything functionally wrong with the case. With eval, you MUST use single quotes to wrap field names on the RIGHT hand side of the eval, whereas double quotes are used on the LEFT hand side, i.e.

| eval "Severity Level" = case('Severity Level'...)

As you have

This shows your eval is correct

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 
| append 
    [| makeresults 
    | eval "Severity Level"=split("critical,high,medium,low", ",") 
    | mvexpand "Severity Level"
        ] 
| fields - _time 
| eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

but you could just do

| eval "Severity Level" = case('Severity Level' == "critical", 1,
                               'Severity Level' == "high", 2, 
                               'Severity Level' == "medium", 3, 
                               'Severity Level' == "low", 4, 1==1, 'Severity Level')

as the final case statement is just saying that it will take the value of Severity Level - unless you may have some other value.

 

View solution in original post

jotne
Builder

A small tip:

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 

Can also be created like this:

| makeresults count=4
| streamstats count as "Severity Level"

bowesmana
SplunkTrust
SplunkTrust

There doesn't appear to be anything functionally wrong with the case. With eval, you MUST use single quotes to wrap field names on the RIGHT hand side of the eval, whereas double quotes are used on the LEFT hand side, i.e.

| eval "Severity Level" = case('Severity Level'...)

As you have

This shows your eval is correct

| makeresults 
| eval "Severity Level"=split("1,2,3,4", ",") 
| mvexpand "Severity Level" 
| append 
    [| makeresults 
    | eval "Severity Level"=split("critical,high,medium,low", ",") 
    | mvexpand "Severity Level"
        ] 
| fields - _time 
| eval "Severity Level" = case('Severity Level' == "critical", 1 ,'Severity Level' == "high", 2, 'Severity Level' == "medium", 3, 'Severity Level' == "low", 4, 'Severity Level' == 1, 1, 'Severity Level' == 2, 2, 'Severity Level' == 3, 3, 'Severity Level' == 4, 4, 1=1, null)

but you could just do

| eval "Severity Level" = case('Severity Level' == "critical", 1,
                               'Severity Level' == "high", 2, 
                               'Severity Level' == "medium", 3, 
                               'Severity Level' == "low", 4, 1==1, 'Severity Level')

as the final case statement is just saying that it will take the value of Severity Level - unless you may have some other value.

 

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...